Hot answers tagged

6

Over the years, Cisco has supported various protocols, and has had ACLs for the various protocols, each with a number range for the numbered ACLs (today, we mostly use named ACLs)*: +-----------------------------------------------------+-----------------------+ | Protocol | Range | +------------------...


5

Your access-map is doing exactly what you told it to do. The 2nd entry matches all traffic to or from RFC1918 address space (including your vlan110!) and drops it. The first thing you need to do is figure out exactly what you want your access-map to do. Here's what I think you want: Permit traffic between your (RFC1918) subnet and internet-routable space (...


4

ACL use either hosts or networks, not ranges. Networks are bounded by power of 2 values. Your range doesn't correspond to a single network. The best you can do is split your range into 4 valid networks: 192.168.1.10/31 for IP 10 & 11 192.168.1.12/30 for IP 12 to 15 192.168.1.16/30 for IP 16 to 19 192.168.1.20/32 for IP 20 So you don't have to use 10 ...


4

As per your network topology and to accomplish your requirement in optimised way you can use both public IP address 81.1.1.30 & 81.1.1.31 both ip for static natting for incoming traffic to reach dns servers 192 .168.1.50 & 192.168.1 51 .example below #Ip nat inside souce static 81.1.1.30 192.168.1.50 53 #ip nat inside source stati. 81.1.1.31 192.168....


3

Default nature of inter-Vlan routing is , it enable routing of traffic between different Vlans. After inter -Vlan routing all vlan configured in device can communicate to each other . To block or control or restrict traffic among VLANs Access-list (ACL) configuration is mandatory in devices ..


3

No ! Generally access -list is configured in such way that outbound traffic initiated from LAN subnets only Assuming LAN subnet ip pool is 10.40.1.0/24 Then access list would be Router(config)#access-list 100 permit 10.40.1.0 0.0.0.255 any Router(config)#ip nat inside source list 100 interfàce gigabit Ethernet 0/0 overload So there will be no untranslated ...


2

I've realised as I was looking at my post, I hadn't denied the IPs from the 2 VLANs, but hadn't allowed the remaining VLANs to access. Added those in and it worked a treat. AKA... Ignore this question, as I sorted it myself!


2

Actually access -list is configured and apply to switch virtual interface to restrict or allow tràffic to and from among VLANs . Access-list is mainly used and configure to isolate traffic on same VLANs and allow traffic on different Vlan vise versa as per business requirements


2

No, an ACL applied on an SVI will only affect traffic routed through that SVI. The traffic of interest is layer-2 switched through the access switch, and simply creating an SVI doesn't change that. If you are able to reconfigure the malfunctioning device onto a new subnet, you could create an entirely new subnet using an SVI, put the device into the subnet, ...


1

Your switch is a layer-2 switch. As such, it does not support ACLs using IP addresses. Generally, a layer-2 switch "doesn't know" anything about IP addresses or higher layer protocols.


Only top voted, non community-wiki answers of a minimum length are eligible